Cloud Security Tutorial with Examples.
Cloud security tutorial: IaC scans, policy as code, CIS benchmarks, Pod Security and IAM linting before deploy, then credential and CloudTrail audits.
Intermediate
For developers with core concepts down
Scanning Terraform for Misconfiguration with Checkov
Catch a public S3 bucket and SSH open to the internet in Terraform before anything is deployed: run Checkov, gate on the checks that matter, fix, re-scan.
Policy as Code: Testing Terraform Plans with OPA and Conftest
Write Rego rules and run them on a real terraform plan: untagged resources and SSH open to the internet fail, the fix passes, the policy has its own tests.
CIS Docker Benchmark Checks with docker-bench-security
Run the CIS Docker Benchmark's container checks against a container you start, read each WARN, fix privileged mode and missing limits, and re-run to PASS.
Kubernetes Pod Security Admission: Enforcing the Restricted Profile
Label a namespace restricted and watch Kubernetes reject a privileged pod with the real violates PodSecurity message, then admit the compliant spec.
CIS Kubernetes Benchmark Checks with kube-bench in kind
Run kube-bench against a local kind cluster, read a real FAIL from the CIS Kubernetes Benchmark, fix it in the cluster config and re-run it to PASS.
Linting AWS IAM Policies Before Deploy with Parliament
Lint IAM policy JSON locally with parliament: catch s3:* on *, a mistyped action and a resource mismatch, then gate CI on a least-privilege rewrite.
Auditing the AWS IAM Credential Report with Python
Parse an AWS IAM credential report with Python's csv module: find active root keys, users without MFA, keys over 90 days old and unused credentials.
Hunting in AWS CloudTrail Logs with Python
Search CloudTrail JSON with Python for root console logins, new access keys, IAM policy changes and public buckets, then build a sorted attack timeline.
Also part of Cloud Security
Taught in other topics. Each link opens the lesson in its home topic.
IAM Concepts That Transfer: AWS vs Azure vs GCP
Grant read-only access to one bucket, done in AWS IAM, Azure RBAC, and GCP IAM side by side — the vocabulary differs, the underlying model doesn't.
IAM: Users, Roles, and Policies
Create a least-privilege IAM policy, attach it to a user, hit a real AccessDenied error, then read the policy to see exactly what was missing.
GCP IAM: Roles and Service Accounts
Create a service account, watch it fail with PERMISSION_DENIED, then grant exactly the role it needs — the real workflow behind every GCP access error.
Entra ID: Users, Roles, and RBAC
Create a role assignment scoped too narrowly, hit a real authorization error, then fix the scope and watch the same command succeed.
IAM and Least Privilege
How a policy decision is actually evaluated, why an explicit deny always wins, roles versus long-lived keys, and the wildcard that looks scoped and is not.
Cloud Networking Basics: What's the Same Everywhere
VPCs, subnets, and firewall rules share one model everywhere — the same allow-443-deny-rest rule as a security group, an NSG rule, and a GCP rule.
Docker Security
Harden Docker images and containers: non-root users, read-only filesystems, secrets management, image scanning, and runtime policies.
Security, RBAC, and Observability
Learn Kubernetes RBAC for access control and how to monitor cluster and workload health with logs, metrics, and events.
sensitive = true: What It Hides, and What It Doesn't
sensitive = true masks a secret in plan output, but state keeps it in plain text. Real runs show both, plus why an ephemeral variable is refused.
Building an Incident Timeline from Auth, Web and IDS Logs
Merge SSH auth logs, a web access log and Suricata alerts into one UTC timeline in Python, and fix the timezone bug that puts an attack in the wrong order.
Envelope Encryption and Key Rotation Without Re-encrypting Data
Encrypt data once with a data key, wrap that key with a KEK, rotate the KEK by re-wrapping 32 bytes, and rotate Fernet tokens with MultiFernet in Python.